I built a system around Shibboleth at a University several years ago. We did some extra work to improve the UX. I'm not sure how installing Shibboleth itself we

I built a system around Shibboleth at a University several years ago. We did some extra work to improve the UX. I'm not sure how installing Shibboleth itself went, but from an API use perspective I can't complain. OpenID might be a better choice these days. It was more dream than reality when we picked Shib. If OpenID isn't an option...I'd vote for Shib over cobbling something together yourself from AD.